How You Can Buy AT&T, 
T-Mobile, and Sprint 
Real-Time Location Data 
on the Black Market 


Joseph Cox, DEF CON 27 



“There is a new bail bond database 
company that is geo tracking people. 
People are reselling o the wrong people. 

Call me [REDACTED]” 



Id rather explain it telephonically. I 
know a ton about the subject and the 
industry. Many peoples rights are 
being violated 
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Id rather explain it telephonically. I 
know a ton about the subject and the 
industry. Many peoples rights are 
being violated 


We’d like to test the ping— if I give 
you one of our own US numbers, 
would that work to test? 


If you are paying the 300 sure 


So the number is [REDACTED]. When 
do you think it will be doable? 


Ok let me figure this out 










You know more about location data, or anything else you 

think should be published? 

Signal: +44 20 8133 5190 

Wickr: josephcox 

Jabber: jfcox@jabber.ccc.de 


Email: joseph.cox@vice.com 
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How our source bought that location data 

The supply chain of location data, and the 
different roles companies play in it 

Leaked documents which show the scale of 
this location data market—it’s not a one-off 

How people are still getting location data out 
of the main telecoms through different means 
and how that black market trade works 



Cell tower data 


Few blocks + 























• Assisted GPS (A-GPS) 

• Metres 

• Where inside a building 






How the hell did he do that??? 
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Location Aggregators 
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End User Clients 
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Solutions - 


wa Zumigo 

V.'W Mobile In Context w 


• Remove the consent requirement of stating that information 
is being released by the "carrier". 

• Instead, allow more flexible language, such as: 

— "You authorize the bank and its service providers to use your mobile 
account for verifying your identity and protecting you from fraud." 

★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★ 

• Make the release of carrier data opt-out, rather than opt-in, 
when it is being used to prevent fraud and identity theft. 

★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★ 

• Create a national registry for consumers to opt-in to allow 
their mobile information to be used for fraud prevention 
purposes. 
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VERIFY A LOCATION 


Mobile Device Verify can also confirm the location of a device based on 
a submitted number, returning helpful location information including: 

• Verification of submitted location 

• Current/last geolocation of the device with a timestamp 

• Geolocation latitude and longitude coordinates 

• Estimated location accuracy given available towers for triangulation 

• Proximity of current location to submitted location 

VERIFY AND MONITOR - BOTH ACCOUNT AND LOCATION 

Mobile Device Verify also offers a powerful monitoring feature whereby 
the account and location information can be verified, and you can set 
up monitoring with control over the weeks, days and even hours that 
location on a device is checked as well as the start and end dates of 
monitoring. On-demand reporting is available throughout the duration of 
a monitoring period. 


Identity Verification 

(Select all services currently planned for use and/or testing) 

Tier 1 

Tier 2 

Tier 3 

Tier 4 

Tier 5 

Tier 6 

1-250 

251-1,00 

0 

1,001-5,00 

0 

5,001-10,000 

10,001-20, 

000 

20,001 ♦ 

Mobile Device Verification * 


Mobile Device Account Verification 1 

□ 

$0.25 

$0.23 

$0.20 

$0.18 

$0.17 

$0.16 

Mobile Device Account & Location Verification 2 

□ 

$4.95 

$4.46 

$3.96 

$3.56 

$3.32 

$3.22 

Mobile Device Account & Location Verification Monitoring (per device) 3 

□ 

$12.95 

$11.66 

$10.36 

$9.32 

$8.68 

$8.42 

Mobile Device Verification Report 

n 

Included with Monitoring 


* All items are governed by FCRA guidelines. Charges are assessed for inquiries returning a “Hit” and “No Hit" result for all verification products. 

1 Verifies the submitted information against the mobile carrier billing account information. 

2 Verifies the submitted information against the mobile carrier billing account information & attempts to identify the mobile device location. 

3 Verifies the submitted information against the mobile carrier billing account information & attempts to identify the mobile device location with 

subsequent location monitoring. 

2. User’s intended use of the above service(s) 

is:_. 




VERIFY A LOCATION 

Mobile Device Verify can also confirm the location of a device based on 
a submitted number, returning helpful location information including: 
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Current/last geolocation of the device with a timestamp 
Geolocation latitude and longitude coordinates 
Estimated location accuracy given available towers for triangulation 
Proximity of current location to submitted location 
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the account and location information can be verified, and you can set 
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Mobile Device Account & Location Verification 2 

D 

1 $4.95 

$4.46 

$3.96 

$3.56 

$3.32 

$3.22 


Mobile Device Account & Location Verification Monitoring (per device) 3 

1 SI 2.95 

$11.66 

$10.36 

$9.32 

$8.68 

$8.42 


Mobile Device Verification Report 

□ 



Included with Monitoring 




All items are governed by FCRA guidelines. Charges are assessed for inquiries returning a “Hit” and “No Hit" result for all verification products. 

Verifies the submitted information against the mobile carrier billing account information. 

Verifies the submitted information against the mobile carrier billing account information & attempts to identify the mobile device location. 

Verifies the submitted information against the mobile carrier billing account information & attempts to identify the mobile device location with 

subsequent location monitoring. 
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Motor Vehicle Sales 

Solutions for decisioning, fraud detection and 
collections, all in one place. 



MicroBilt provides a complete set of tenant screening and fraud 
detection tools for landlords and property management companies. 
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Property Management 

Know who you're leasing to, before you sign a contract. 


A complete suite for used car, buy here-pay 
companies. 
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MicroBilt provides a complete set of tenant screening and fraud 
detection tools for landlords and property management companies. 


Motor Vehicle Sales 

unu i is l u Pdecisioning, fraud detection and 
collections, all in one place. 


Property Management 

Know who you're leasing to, before you sign a contract. 


A complete suite for used car, buy here-pay 
companies. 
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BAIL INTEGRITY SOLUTIONS 


MY SOURCE 
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MY SOURCE 


Welcome to CerCareOne 




Welcome to CerCareOne 


Thank you for visiting our site, however, it is currently under construction. 






Accounts 


Company Username 
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2017-06-27 13:13:50 
2017-06-27 11:11:33 
2017-06-26 19:49:58 
2017-06-26 19:48:04 
2017-06-26 19:46:27 
2017-06-26 19:45:08 
2017-06-26 19:43:30 
2017-06-26 19:41:56 
2017-06-26 16:53:02 
2017-06-26 15:27:35 


Found 

CELL: 582 

Found 

CELL:448 

Found 

A-GPS:21 

Found 

A-GPS:18 

Found 

A-GPS:13 

Found 

A-GPS:13 

Found 

A-GPS:13 

Found 

A-GPS:21 

Found 

A-GPS:31 

Found 

CELL: 3502 



e. The subscriber agrees to use their best efforts to safeguard their username and password and may be prompted 
periodically to change the password being used. 

f. The subscriber is aware of and agrees to supply to Cercareone.com a maximum of two (2) IP addresses from which 
access to Cercareone.com will be limited to further ensure privacy and limited access & attests that said IP addresses 
belong to the subscriber. 
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e. The subscriber agrees to use their best efforts to safeguard their username and password and may be prompted 
periodically to change the password being used. 

f. The subscriber is aware of and agrees to supply to Cercareone.corja maximum of two (2) IP addresses J*om which 

access to Cercareone.com will be limited to further ensure privacy addresses 

belong to the subscriber. 



2017 - 06-26 11 : 35:47 
2017 - 06-26 11 : 04:51 
2017 - 06-26 10 : 46:45 
2017 - 06-23 11 : 37:40 
2017 - 06-22 21 : 24:38 
2017 - 06-22 21 : 19:30 
2017 - 06-21 08 : 53:31 
2017 - 06-21 08 : 52:49 
2017 - 06-20 20 : 48:18 








Administration 

Accounts Reports 
Plans Search 

Billing history for 


Date Amount 

2016 - 09-15 13 : 58:47 $1100 

2017 - 02-17 12 : 34:16 $1100 


@gmail.com 


Transaction ID 











CerCareOne 




Log out 


To update the map please use the Update Location link. Do not refresh your browser. 




i 


m 


4 


‘-'HI w. i 


v 

)n!ine 




i! 




i 




n r ' 


*•» 






f 


A 


f 


A. * J * 

I r W m 




.it as 


► . 


/S plash" 

bhu 


Vj 


Number 

Address: 6309 1-30. Greenville. TX 75402. USA 
Lat Long: 33 104714.-96 103163 rl34 
Location Technology: A-GPS 
Tune 201 7 -05-30 11:14:23 pm EST 


L'pdate Location 

Bmg Map 

Back to Account Page 

Pay per Ping balance: $226.00 
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Map data 5-2017 Google £20^ ? Dg:U‘G1cfce Texas Orthcxmage^ Prograrr USOA Farm Service Agency Jems of Use 

















Can’t Find Your 
CellPhone? __ 


Can’t Find Your 
Loved One? 




1J 


WE CAN HELP! 







Instantly Locate Defendant 
Cell Phone 


• All major carriers - Verizon, AT&T, Sprint 
& T-Mobile 

• Tower triangulation and GPS 
(if available) 

• See location on Google Maps 


No response-no charge 




ORDER NOW 







Instantly Locate Defendant 
Cell Phone 



• All major carriers ! Verizon, | T&T, Sprint 
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ALL COVERAGE 





TECH BY VICE 


AT&T to Stop Selling 
Location Data to Third 
Parties After Motherboard 
Investigation - 

After Motherboard found that AT&T, T-Mobile, anc 
selling their customers' phone location data ultirm 
hunters, AT&T has decided to stop service for all I 
aggregators, an essential part of the data supply < 

By Joseph Cox 



TECH BY VICE 



Sprint to Stop Selling 
Location Data to Third 
Parties After Motherboard 
Investigation 


After AT&T and T-Mobile said they would stop selling their 
customers’ phone location data to third parties, Sprint followed 
suit. A Motherboard investigation found all three telcos selling data 
that ultimately ended up in the hands of bounty hunters. 


By Joseph Cox 



But wait, that’s not the end. 
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Deleted Account 

last seen a long time ago 


J i 2:28 AM 


2:28 AM 
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For right now 2;49 PM ^ 
You see that number 2; 57 pm > 2 / 
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3:04 PM 
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long 

3:19 PM 


Thank you 9 3;19PMv ,/ 


Pms 3:23 P 


Delete this chat 


© 


10:47 


Deleted Account 

last seen a long time ago 


Power powered off 2 4 


June 12 


816- 


For 11 Pm PST 7;30 PM ^ 


June 13 
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Lat long 
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12:23 AM v*' 


OK 
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You know more about location data, or anything else you 

think should be published? 

Signal: +44 20 8133 5190 

Wickr: josephcox 

Jabber: jfcox@jabber.ccc.de 


Email: joseph.cox@vice.com 




